Jel imaš instalaciju svog windowsa na cd-u?

O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
AtiPTA
"Control panel for the ATI series of video cards allowing access to such features as display resolution

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
NeroFilterCheck
Associated with "Nero Burning Rom" CD writing software. Checks for driver issues

O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
DownloadAccelerator
"Download Accelerator Plus from Speedbit. Download manager for resuming downloads

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
QuickTime Task
System Tray access to Apple's "Quick Time" viewer from version 5 onwards

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
RemoteControl
"Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
Unknown Item
Sorry. We are not sure what this item is. If you would like, you can click on it to request additional information about it.

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
AVP
"Added by the MUTBO-A TROJAN!"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
kernelfaultcheck
"Used in connection with memory dumps - you can disable these by - right clicking on My Computer

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
msnmsgr
"MSN Messenger utility. If you don't use MSN Messenger

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL


Ovo je sve krš,briši...a ima još

Da.Shvati brate nije problem u tome,vidis da je worm zarazio bitan file i da je sad sve otislo u 3 lepe...Najbolji nacine je repair ako je ono sto kazete da jeste...Sawmo zamnejuje pokvarene fajlove

Mada uradio sam sta si rekao..

Sve ja kapiram,samo gledam kako da ti pomognem...vidi,repair će ti obnoviti fajlove što se tiče windowsa ali ako si zapatio nešto na disku i dalje će ostati tako da ni repair nije 100% rešenje,al ajde probaj pa da vidimo...

Ubaci taj instalacioni cd,boot-uj ga iz BIOS-a (mislim da ne može iz vindowsa,nisam siguran,probaj i to) i ponudiće ti opciju REPAIR,dalje ćeš lako sam...ajd pa javi šta si uradio...

Repair ti neće škoditi,odradi ga

Ovo prijavljuje da je trojanac...
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
AVP

Ako ima opcija repair uradicu to,mada sad pitam sestru jel joj sta ponudio kaze da nije(iz windowsa)..Aj malo detaljnije opisi sta si mislio kad si rekao da ono prijavljuje kao trojanca..


Sve sam fixirao navedeno..

Evo ga novi log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:05:43 AM, on 12/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\National Instruments\MAX\nimxs.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - C:\Program Files\National Instruments\MAX\nimxs.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe

--
End of file - 2932 bytes

 

kavex

Ne analiziraj ljudima logove, posto ocigledno to ne umes i savetujesim da brisu regularne sistemske unose.
Ako sam posle 7 strana trazila log, uradila sam to verovatno zato sto na prethodnih 7 strana niste uradili nista kako treba.
Ali posto vidim da mi ne dozvoljavate da isti analiziram, niti onaj kome je receno od strane moda da zakaci novi log ne ceka moderatora da isti i pregleda, nastavite da se sprdate svi zajedno.
Puno srece.

Jedno malo pitanjce:kako da pokrenem instalaciju iz biosa a ne iz windowsa nakon sto ubacim instalacioni cd u komp??????